The Rise of Fake Shipment Tracking Scams in MEA

This Group-IB report describes a global fake shipment-tracking phishing campaign—likely enabled by the Darcula Phishing-as-a-Service—where attackers use SMS sender ID spoofing, cheap disposable domains, mobile-optimized pages, and embedded WebSocket scripts to perform real-time keylogging and exfiltrate personal and payment data; the report includes IOCs, affected industries/regions, HTML/infrastructure analysis, and defensive recommendations.